3 ms·

Well, I hope on Matrix we've not been blindly namedropping axolotl/double-ratchet: instead we've tried to be as transparent as possible (more-so perhaps than OW

Well, I hope on Matrix we've not been blindly namedropping axolotl/double-ratchet: instead we've tried to be as transparent as possible (more-so perhaps than OWS) in terms of speccing what we've been doing (https://matrix.org/docs/spec/olm.html https://matrix.org/docs/spec/olm.html, https://matrix.org/docs/spec/megolm.html https://matrix.org/docs/spec/megolm.html, http://matrix.org/docs/olm_signing.html http://matrix.org/docs/olm_signing.html, https://matrix.org/speculator/spec/drafts%2Fe2e/client_server/unstable.html#end-to-end-encryption https://matrix.org/speculator/spec/drafts%2Fe2e/client_serve... etc). Thanks to the Open Tech Fund we also got libolm audited by NCC Group - and we've ensured that the audit report will be publicly released (mid-Nov). Hopefully the audit & the code will speak for itself, and certainly speak stronger than bios.

tptacek 10y ago
I started NCC Group Cryptography Services. They're great, but I'm telling you, no: the bios are important. A single point in time audit doesn't make something secure.
- Arathorn 10y ago
  Well, thanks for starting NCC Group Crypto then :) One can at least extrapolate from an audit - it surely tells you how competent the code is at a point in time, and how rapidly and competently any issues were resolved, and one can assume the same team will progress similarly. In terms of bios: the folks working on libolm have 10-15 years each of professionally writing decent security-conscious native code, the vast majority of which (pre-Matrix) has been proprietary, with the exception of occasional contributions to things like Wireshark. I don't think they'd have described themselves as specialising in cryptography before embarking on libolm, but the team's learnt a lot along the way and the label might be more appropriate now. Ooi, what would you consider an appropriate bio? (short of being DJB or Moxie? :)

tptacek 10y ago

I started NCC Group Cryptography Services. They're great, but I'm telling you, no: the bios are important. A single point in time audit doesn't make something secure.

Arathorn 10y ago
Well, thanks for starting NCC Group Crypto then :) One can at least extrapolate from an audit - it surely tells you how competent the code is at a point in time, and how rapidly and competently any issues were resolved, and one can assume the same team will progress similarly. In terms of bios: the folks working on libolm have 10-15 years each of professionally writing decent security-conscious native code, the vast majority of which (pre-Matrix) has been proprietary, with the exception of occasional contributions to things like Wireshark. I don't think they'd have described themselves as specialising in cryptography before embarking on libolm, but the team's learnt a lot along the way and the label might be more appropriate now. Ooi, what would you consider an appropriate bio? (short of being DJB or Moxie? :)